STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

DISA Rule

SV-273569r1110905_rule

Vulnerability Number

V-273569

Group Title

SRG-NET-000018-RTR-000001

Rule Version

RCKS-RTR-000010

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure ACLs and filters to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

1. Configure access-list filter to control flow of information between interconnected networks in accordance with appliable policy. In this example, SSL traffic is permitted to a specific internal host.
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

2. Apply access list to external interface.
interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that access control lists (ACLs) and filters are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

In this example, SSL traffic is permitted to a specific internal host.

interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Vulnerability Number

V-273569

Documentable

False

Rule Version

RCKS-RTR-000010

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that access control lists (ACLs) and filters are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

In this example, SSL traffic is permitted to a specific internal host.

interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Check Content Reference

M

Target Key

5696